CVE-2026-17603

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 (affected versions not specified)

Description Insufficient restrictions on HikariCP connection-pool properties within the DataStore configuration API allow a user with the nx-datastores-update permission to set the connectionInitSql property. This enables the execution of arbitrary SQL against the configured database whenever a new connection is established. When using the default H2 database backend, this flaw can be exploited to achieve remote code execution with the privileges of the Nexus process user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.